Network-independent ACLs: Why Security Shouldn't Depend on Your Network
summary
Compares traditional network-based ACLs (firewall rules tied to IPs/ports implemented by Kubernetes CNI backends like Flannel or Calico) with an alternative that uses pod labels as metadata for enforcement so NetworkPolicies act as API-level authentication independent of the network. Describes pros and cons and specific use cases for each model, and introduces a label-only implementation of NetworkPolicies that avoids relying on network primitives.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:09Security levels
- 1:49Perimeter security
- 2:13Micro-Services
- 2:44Distributed firewalls
- 3:24SDN and VPN solutions
- 5:15Provisioning assets
- 12:41Explicit activation per namespace
- 14:28Rules are additive
- 24:30Encryption
- 34:42Identity added on TCP flows handshake
related talks
34mTowards a Standardized Identity-based Authorization in Kubernetes
31mSecuring Cluster Networking with Network Policies
40mKubernetes Networking Panel: Collaborate on the Spec, Compete on Execution
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
50mPanel: Whither Security in a Cloud-Native World?
21mFrom Squire To Network Knight: Defending the Kubernetes Castle the Cloud Native...
06mKeynote: Progress Toward Zero Trust Kubernetes Networks
33mNavigating the Container Jungle